linux-kernel - Re: PROBLEM REMAINS: [sata_nv ADMA breaks ATAPI] Crash on accessing DVD-RAM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 12 Jan 2008 14:35:17 -0600
From:	James Bottomley <James.Bottomley@...senPartnership.com>
To:	Robert Hancock <hancockr@...w.ca>
Cc:	Alexander <aledin@...l.ru>, linux-kernel@...r.kernel.org,
	ide <linux-ide@...r.kernel.org>, Jeff Garzik <jeff@...zik.org>,
	Tejun Heo <htejun@...il.com>
Subject: Re: PROBLEM REMAINS: [sata_nv ADMA breaks ATAPI] Crash on
	accessing DVD-RAM

On Sat, 2008-01-12 at 13:25 -0600, Robert Hancock wrote:
> Alexander wrote:
> > Robert Hancock wrote:
> >> There's this patch which was intended to fix it:
> >>
> >> http://lkml.org/lkml/2007/11/22/148
> > 
> > I applied this patch to 2.6.24-rc7. Now at boot time my DVD-RW is
> > normaly detected as:
> > 
> > sr0: scsi3-mmc drive: 48x/48x writer dvd-ram cd/rw xa/form2 cdda tray
> > 
> > But I cannot mount it. All my attempts failed with
> > 
> > ISOFS: Unable to identify CD-ROM format.
> > 
> > With mem<=4098M or sata_nv.adma=0 it still mounts and works ok.
> 
> As I wrote, it would appear that somehow the blk_queue_bounce_limit 
> setting that the driver has made is not being respected and the block 
> layer is still trying to feed it addresses over 4GB. Any ideas anyone?

Actually, I'd be very sceptical that the blk_queue_bounce_limit isn't
working as advertised; there'd be a large number of failures if it were
not.

However, the "as advertised" part doesn't seem to be generally well
understood.  The point being that block commands are only bounced if
they come from the filesystem or the user, not if they're generated
directly inside the kernel.  Since the fault occurs before mount, it's
suggestive of the latter.

A long time ago, GFP_KERNEL allocations meant that the memory allocated
was physically under 4GB.  Then x86_64 (and before it ia64) wanted to
break this.  So they introduced a new flag:  GFP_DMA32 that behaved like
the old GFP_KERNEL and then changed GFP_KERNEL on their architectures to
return memory from anywhere.  I'd strongly suggest some piece of kernel
memory was allocated for a transfer buffer without GFP_DMA32 and then
passed in to the driver.  Unfortunately, that could be anywhere inside
cdrom or sr.  Knowing what the actual command is might help ... some of
the distinctive MMC media ones only have a single source.

James

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/